It used to be that phishing emails were easily sniffed out due to the poor grammar. It was always immediately clear that they were coming from non-native speakers and, hence, obviously not the product of the major bank, etc. they claimed to represent. And, I always thought, "Good grief, if these guys would only hire native English speakers to write their crap (or simply copy a legit e-mail) and take a couple of other similarly easy steps, they'd be in business in a big way".

It all pointed to the fact that there'd be a day when their increased sophistication, coupled with their boldness, would make it nearly impossible for the average person to sniff them out. And, beyond that, even seasoned tech folks would someday be vulnerable. That day is fast approaching.

The good guys are losing and we need a completely new model for dealing with this stuff. "Protecting" access to information has long been an untenable goal, and any new model must make it such that everyone's personal information could be completely public without that fact exposing them to any risk. It's nuts that we all walk around with just a few bits of info which, if gleaned by a bad guy, could completely destroy us. It's also nuts that we walk around with a couple of numbers that we are routinely encouraged to give out to a myriad of people/systems, but if they ever once fell into the wrong hands, could be a gold mine for a scammer.

We also need more international cooperation combined with super-stiff penalties, as there is currently no downside risk for these guys. The current model is esentially: Try. If it doesn't work or the fraudster is discovered, then try again.